Send this info to a friend

Privacy note: We won't use your friend's e-mail for anything other than sending this message. See our privacy policy.

AA

Debunking the hype over ID theft

You don't need a costly service to protect your good name

Consumer Reports Money Adviser: February 2012

Almost 50 million people subscribed to some form of identity-theft protection in 2010. Those services, which cost about $120 to $300 a year, promise to protect your ID by monitoring your credit reports 24/7, scouring “black-market chat rooms” for your personal information, removing your name from marketing lists, and filing fraud alerts. Some throw in up to $1 million in insurance.

More of these pitches are coming from banks, which account for more than half of the $3.5 billion a year spent on ID-theft protection subscriptions. In a sense, consumers who buy this protection from their banks are helping to foot the bill for services that financial institutions are obligated to provide by federal law to shield their customers from losses stemming from credit-card and bank-account fraud.

In the past we’ve found that these protection plans provide questionable value. And some promoters of these services have been slapped by the Federal Trade Commission for misleading sales practices and false claims. We dug into the latest products sold by more than two dozen banks, credit-reporting bureaus, and independent companies. Here’s what we found:

Marketers use fear as a sales tool

The claim. Some ID protectors scare up business with inflated claims about crime. “There were 1.2 million more victims in 2009 than 2008,” Chase warned on its website. “And with a growing 11 million victims each year, one of those identities could be yours.”

The facts. That promo, which ran in November 2011, was based on statistics that were out of date. The latest available data show that in 2010 identity fraud fell 27 percent, to 8.1 million victims. As of last fall, Experian Protect MyID was also still claiming that ID theft is “one of the fastest-growing crimes.”

More significant, identity fraud is down because financial institutions are doing a better job preventing it. And consumers have become more eagle-eyed about their own accounts, without the need for a paid subscription service.

What you should do. Take the threat seriously, but don’t panic. Even the statistic of 8 million victims overstates the danger. More than 80 percent of what’s been called identity theft involves fraudulent charges on existing accounts, according to the U.S. Department of Justice, but in most cases a cardholder’s liability is limited to $50 for a lost or stolen credit card. For debit cards, liability for an unauthorized transaction is limited to $50 if it’s reported within two business days of the date a cardholder learns of it. After two days, liability can climb to $500 or more, but many banks provide additional voluntary protections.

What’s relatively rare is “new account” and “personal information” ID theft, in which someone uses your name, birth date, and Social Security number to open new credit accounts, tap your health insurance, earn taxable income, or commit crimes in your name. Only 765,000 households were victims of this form of ID theft in 2010, according to the Bureau of Justice statistics, which means the chance of it happening to you is less than 1 percent a year.

A trial offer signs you up for recurring fees

The claim. Fifth Third Bank, which serves 15 states, most in the Midwest, and Affinion, a leading provider of ID-protection products to banks, market Identity Alert by offering 30 days of service for $1. Customers can sign up online and must provide credit-card billing information to pay the small fee.

The facts. Giving up your credit information also allows Affinion to automatically charge your card a monthly membership fee after the trial period, which is disclosed on the sign-up form. Of course, you can cancel at any time, but auto-charging your credit card forces you to do all the work to opt out.

During the last three years consumers have filed more than 2,500 complaints against Affinion with the Better Business Bureau (which gives the company a C- rating), mostly related to advertising, sales, billing, and collections. Affinion is also the target of more than a half-dozen class-action lawsuits, a civil suit by the state of South Carolina, and investigations by many state attorneys general—all related to its marketing and sales practices.

Michael Bush, an Affinion spokesman, says those cases involve “marketing practices that we voluntarily ceased over two years ago.” In 2010, one of them cost Affinion $8 million in penalties, costs, and restitution to settle with New York state for sending consumers checks, which, when deposited, automatically enrolled them in a variety of its programs, including Privacy Guard and IDSecure.

What you should do. Before signing up for one of these services, check out the company with the Better Business Bureau. If you see a pattern of complaints about deceptive sales tactics, steer clear.

Credit monitoring can miss a lot

The claim. Identity-protection companies typically claim they provide you with the tools and support you need to guard against the many ways your information might be compromised. For example, Wells Fargo promises to “protect your identity and your credit profile” with its Identity Theft Protection plan, which is delivered by Trilegiant, an Affinion company.

The facts. The core of the Wells Fargo plan and many other protection products is monitoring your credit report. But most of what promoters call ID theft is unlikely to be picked up by credit monitoring, which looks for new accounts that pop up in your credit file. If monitoring does detect suspicious activity, such as someone opening a new credit account in your name, you probably won’t know about it until days or weeks later because of the lag time in reporting.

Robert Dudacek, a Wells Fargo executive in charge of services for insurance and ID protection, agrees that “consumers have essentially zero liability” for existing account fraud. But he says Wells Fargo’s product reduces late-reporting problems by monitoring all three credit bureaus—Equifax, Experian, and TransUnion—because one or two bureaus might not even pick up a new fraudulent account in the first place.

What you should do. Sign up for free alerts from your credit-card issuer and bank that will let you know when, say, a charge above $100 is made to your credit card or if your checking balance falls below a certain amount. Alerts could signal unexpected trouble, and they’re quicker and cheaper than credit monitoring. You can also do your own monitoring by getting free annual credit reports from each bureau, staggering your requests every four months from one bureau to the next. (Go to annualcreditreport.com to do this.)

Million-dollar insurance doesn't cover much

The claim. American
Express ID Protect Premium, provided by Affinion, says its $16 monthly
fee includes “up to $1 million in identity theft insurance.”

The facts. Before you
bank on that claim you’d better read the limitations and exclusions
that apply under the Chartis master policy No. 7077733, which provides
the insurance. But that might be tough to do, since the American
Express website doesn’t provide the policy until after you enroll. We
found some important limitations in the fine print.

To begin with, ID-theft
insurance is secondary to any other coverage that might pay out first,
such as homeowners or renter’s insurance, and it mostly covers low-cost
incidentals related to or resulting from the crime—notary fees,
credit-report costs, loan re-application fees, and a maximum of $1,500
in wages lost “solely” to fix your identity records.

What’s more, the one expense
you might really need this coverage for—to pay criminal defense costs
if you’re charged with a crime committed by your ID thief—will be paid
only “after it has been established by acquittal or dismissal of
charges” that you didn’t do it. What do you do for attorney fees in the
meantime? Christine El Eris, Affinion’s director of products, says
you’ll probably have to pay them up front, but you’ll get the money
back if you’re innocent. Leah Gerstner, an American Express
spokeswoman, said the threat of being falsely accused of a crime is
tiny. “I don’t think that’s something that truly happens a lot,” she
says.

What you should do.
Don’t rely much on insurance to protect you. Instead, take the free,
do-it-yourself common-sense precautions described in the next section
to help prevent ID theft in the first place.

Free protections as effective as paid

The claim. Most ID-theft products say they offer “comprehensive” protection.

The facts. There are
things you can do free that are equally—if not more—effective in
reducing fraud losses. Among 439 victims of ID fraud surveyed by
Javelin Strategy & Research, a consulting firm in California, the
average amount stolen was $4,607. Victims who learned of the crime
through an ID-theft protection plan had only $3,363 taken, on average.
But those who discovered the crime when their bank or credit-card
provider notified them of suspicious activity saw an average of only
$2,861 stolen. Those who found the theft through their own monitoring
of accounts saw losses of $2,791, on average. And people who uncovered
the fraud by simply reviewing their paper statements saw an average of
only $2,195 taken.

Of course, because of federal
consumer protections and loss-liability limits, actual out-of-pocket
fraud costs for victims are significantly lower than the amount stolen.
While the average ID-fraud loss was $4,607 for all victims, the out-of
pocket cost to consumers averaged only $631, Javelin found. By
comparison, the average fraud loss for ID-protection or
credit-monitoring customers was $3,363, with out-of-pocket costs
averaging only $587.

What you should do. Do
it yourself for less. Sign up for online access to your bank and credit
accounts and monitor them frequently. Periodically check your credit
reports. Put a security freeze on your credit reports, use security
software on all your computers and smart phones, and respond
aggressively to any hint of trouble.

Web monitoring offers false security

The claim. Intersections, which markets Identity Guard programs, also uses credit monitoring as the core of its products. But it adds “Internet surveillance” to the mix, as a number of other services do. “If we see that your personal information—Social Security number, credit-card or bank-account numbers—is exposed online, we’ll alert you,” the company says.

The facts. Once your information is out there, you can’t get it back. “We only give you alerts,” says Steve Schwartz, an Intersections executive. “The genie is out of the bottle.” As David Kroner, vice president and general manager of card services and insurance at American Express, points out, there’s no form you can fill out to have your data removed from a black-market website. American Express sells Affinion’s product under the ID Protect label.

IdentitySecure’s Social Security Number Fraud Watch is said to use “continuous real-time Web-crawling technology to monitor illicit Web portals,” where Social Security numbers are bought and sold by thieves. But the executives from protection companies we spoke with wouldn’t or couldn’t give details about how comprehensive these scans are. And IdentitySecure’s fine print says the company “does not guarantee that it will apprise you of all instances that your SSN or associated records may have been compromised.”

What you should do. Internet scans could give you a false sense of security if they find nothing and scare you if they find something you can’t undo. Assume the genie is already out of the bottle and put a security freeze on your credit report before trouble strikes. A freeze prevents new creditors from getting access to your file when someone tries to open an account. Without access to the file, creditors are more likely to deny the crook’s credit application.

Other reports can tip you off to fraud

The credit-reporting bureaus aren’t the only repositories of your personal data. Information in other databases can indicate that a crook is using your identity. You can check these reports each year without charge:

LexisNexis Full File Disclosure includes a public-records search, reports on claims for auto and homeowners insurance, pre-employment background checks, an “Esteem” report if you ever admitted to or were convicted of shoplifting, results of a national criminal-records search, and address history. Go to personalreports.lexisnexis.com and click on “Access Your Personal Information.”

Annual Statement of Medical Benefit shows your record of health-insurance claims and medical treatment. Call or write your insurer to get a copy of the statement.

Prescription Drug History contains information about the prescription drugs you’ve used over the last five years, including dosages, your refill record, and the prescribing doctors. Call Intelliscript at 877-211-4816 and Medpoint at 888-206-0335.

Chex Systems and TeleCheck Reports have information about mishandled and overdrawn checking accounts. On the Chex Systems site, at www.consumerdebit.com, click on “Order Consumer Report.” TeleCheck is at www.firstdata.com/telecheck/telecheck-request-file-report.htm.